Banking and Finance Law Daily Wrap Up, UNFAIR, DECEPTIVE, ABUSIVE ACTS OR PRACTICES—FDIC clarifies no intent to deny payment processing services to businesses operating legally, (Sep 30, 2013)

By Richard A. Roth, J.D.

The Federal Deposit Insurance Corporation has issued new guidance intended to make clear that banks must be careful when offering payment processing services to merchants that are engaged in higher-risk activities but are not prohibited, or even discouraged, from doing so. According to the FDIC, banks that have appropriate risk management systems in place and that oversee the processors’ activities properly will not be criticized by examiners for providing services to legal businesses (FIL-43-2013).

“Higher risk activities” are activities that present a higher than usual risk of consumer fraud or other illegal activities, the FDIC says. They are characterized by unusually high rates of returned transactions, unauthorized transactions, or consumer complaints, or by evidence of state or federal investigations. Payments typically involve remotely created checks or automated clearing house debits initiated by the processor on behalf of the merchant.

The FDIC warned banks of the risks of payment processing relationships with these types of businesses in early 2012 (FIL-3-2012). In that Financial Institution Letter, the agency noted telemarketers and online merchants as examples of merchants that could present a concern.

Potential risk signs. In its 2012 letter, the FDIC described several signs that could indicate to a bank that a relationship presents a risk. These include:

• payment processors that use more than one bank to process payments;

• payment processors that move from one bank to another in a short period of time;

• payment processors that seek relationships with banks that need to raise capital quickly, especially if the processor promises to make a large deposit or buy stock in the bank;

• an increase in consumer complaints about the processor or its merchant clients, whether made to the bank, consumer advocacy organizations, or even websites or blogs; and

• an increase in the number of returns or charge-backs.

Required risk mitigation. Banks need to assign clearly the responsibility for overseeing the risks that arise from relationships with payment processors, the FDIC said in 2012. This includes overseeing the accounts to detect indications of inappropriate activity. A bank’s policies and procedures should set thresholds for an acceptable level of returns and outline the bank’s possible responses if a threshold is crossed. The bank also should authenticate the payment processor’s business operations and assess the level of risk those operations present.

Relationships permitted. However, the need for caution does not mean that relationships with these payment processors are to be avoided, the new FIL says. If the necessary risk assessments are performed and the necessary due diligence and monitoring are carried out, there is no reason to avoid these business relationships.

Examinations will be focused on whether relationships are being properly managed, the FDIC says, not on discouraging the relationships.

RegulatoryActivity: BankingOperations CreditDebitGiftCards UDAAP